diff --git a/COMPATIBILITY.md b/COMPATIBILITY.md
index 57b6f48be6..872c76a41d 100644
--- a/COMPATIBILITY.md
+++ b/COMPATIBILITY.md
@@ -6,7 +6,7 @@ New operator-facing names use PastureStack and `PASTURESTACK_*`. Compatibility i
## Docker host policy
-Release `0.183.308` preserves the Docker host policy introduced in `0.183.299`,
+Release `0.183.309` preserves the Docker host policy introduced in `0.183.299`,
which adds Docker Engine `29.8.0` as an exact supported
version alongside the preserved legacy ranges, `24.0.9`, and the existing
`29.4.1` through `29.7.2` interval. It does not widen the interval to admit
@@ -97,6 +97,14 @@ remain compatible. They are correlation inputs, not bearer credentials, and do
not weaken the existing CSRF, Origin, MFA, ticket-expiry, or account ownership
checks.
+Authentication configuration updates must preserve the caller's platform
+authorization credential through the Engine-to-Authentication-Service proxy.
+The provider access token remains appropriate for read-only identity and
+configuration enrichment, but cannot substitute for the operator session when
+the Authentication Service consumes a bound MFA confirmation. Server release
+gates must exercise the public `/v1-auth/config` path rather than validating
+only the Authentication Service's loopback endpoint.
+
The `rancher.compose.*` setting keys and inherited executable aliases remain compatibility contracts for existing launchers. Public artifact URLs and container images are hosted under the PastureStack GitHub organization; remove an alias only after its launcher and rollback fixtures accept the replacement name.
## Host API token rollout
diff --git a/README.md b/README.md
index 9b272b837c..d5aa0f4308 100644
--- a/README.md
+++ b/README.md
@@ -9,8 +9,8 @@ PastureStack is an independent community effort to preserve, audit, and moderniz
## Project status
The current public GitHub Release
-[`v0.183.308`](https://github.com/PastureStack/orchestration-engine/releases/tag/v0.183.308)
-produces engine version `0.183.308`. It retains the existing Java 25, Ubuntu
+[`v0.183.309`](https://github.com/PastureStack/orchestration-engine/releases/tag/v0.183.309)
+produces engine version `0.183.309`. It retains the existing Java 25, Ubuntu
26.04, Maven, Liquibase, MariaDB/MySQL, WebSocket, dependency, concurrency, and
runtime-hardening work from the maintained compatibility line. Release builds
consume the exact `5.7.4` runtime JAR published by
@@ -21,6 +21,15 @@ product identity and provenance are carried by the artifact name, metadata,
SBOM, and release evidence. Provenance and scope are documented in
[`third-party/HAZELCAST.md`](third-party/HAZELCAST.md).
+Release `0.183.309` preserves the authenticated PastureStack operator
+credential when an administrator posts `/v1-auth/config`. Earlier releases
+replaced that credential with the external identity provider's access token;
+Authentication Service could parse the requested OIDC access policy, but its
+session-bound MFA confirmation call back to the control plane was rejected
+before the ticket consumer ran. Read-only authentication configuration and
+identity enrichment continue to receive the provider access token, so this
+fix does not weaken or remove the established provider lookup path.
+
Release `0.183.308` completes session-bound logout for both v1 and v2 API
clients. The frozen v1 `base`, `superadmin`, and `token` schema snapshots now
publish the same fixed-format, sensitive, create-only `clientSessionId` input as
@@ -110,7 +119,7 @@ dependency line. The existing platform JSON surface remains on
`com.fasterxml.jackson` 2.22. Packaging gates admit only the reviewed,
version-pinned pair and verify that their class namespaces are disjoint.
-Host compatibility is evidence-based. Release `0.183.308` preserves the legacy ranges and Docker Engine `24.0.9`, retains the bounded `29.4.1` through `29.7.2` interval, and supports exactly `29.8.0`. It does not admit unverified `29.7.3` or `29.8.1`, or Docker 25 through 28. The frontend marks versions above the configured newest version as *untested*, not *supported*. Every Server release that consumes this policy must still pass its Ubuntu 26.04 host and installed firewall-backend runtime acceptance gate.
+Host compatibility is evidence-based. Release `0.183.309` preserves the legacy ranges and Docker Engine `24.0.9`, retains the bounded `29.4.1` through `29.7.2` interval, and supports exactly `29.8.0`. It does not admit unverified `29.7.3` or `29.8.1`, or Docker 25 through 28. The frontend marks versions above the configured newest version as *untested*, not *supported*. Every Server release that consumes this policy must still pass its Ubuntu 26.04 host and installed firewall-backend runtime acceptance gate.
The build and Dapper images still compile the Docker `29.7.2` CLI from the pinned official tag commit with Go `1.27.0`; the CLI tool version is separate from the Docker daemon host support setting. They do not import Docker's precompiled Go `1.26.5` binary. The source archive SHA-256 and Go builder image digest are enforced by the source gate and the resulting images are scanned before release.
@@ -158,7 +167,7 @@ The gate performs dependency-hygiene checks, builds every Maven module with JDK
To create the complete release archive after the gate passes:
```sh
-ENGINE_VERSION=0.183.308 bash scripts/build --release
+ENGINE_VERSION=0.183.309 bash scripts/build --release
bash scripts/check-release-artifact dist/artifacts/cattle.jar
```
diff --git a/code/framework/api-pub-sub-jetty/pom.xml b/code/framework/api-pub-sub-jetty/pom.xml
index 2b8a61ae5f..c527fa1033 100644
--- a/code/framework/api-pub-sub-jetty/pom.xml
+++ b/code/framework/api-pub-sub-jetty/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/framework/api-pub-sub/pom.xml b/code/framework/api-pub-sub/pom.xml
index 5e0f85f73c..e4eb8f25c8 100644
--- a/code/framework/api-pub-sub/pom.xml
+++ b/code/framework/api-pub-sub/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/framework/api/pom.xml b/code/framework/api/pom.xml
index e30f34e046..f46e4451a4 100644
--- a/code/framework/api/pom.xml
+++ b/code/framework/api/pom.xml
@@ -4,7 +4,7 @@
cattle-parent
io.cattle
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/framework/archaius/pom.xml b/code/framework/archaius/pom.xml
index 719182e93e..88544227f7 100644
--- a/code/framework/archaius/pom.xml
+++ b/code/framework/archaius/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-meta-parent
- 0.183.308
+ 0.183.309
../../meta-parent/pom.xml
diff --git a/code/framework/async/pom.xml b/code/framework/async/pom.xml
index 26320c3c59..bc1990ca6e 100644
--- a/code/framework/async/pom.xml
+++ b/code/framework/async/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/framework/auditing/pom.xml b/code/framework/auditing/pom.xml
index b33fb377a3..daf74f3226 100644
--- a/code/framework/auditing/pom.xml
+++ b/code/framework/auditing/pom.xml
@@ -4,7 +4,7 @@
cattle-parent
io.cattle
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/framework/db-loader/pom.xml b/code/framework/db-loader/pom.xml
index 03b212a9db..f6aff77c40 100644
--- a/code/framework/db-loader/pom.xml
+++ b/code/framework/db-loader/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/framework/deferred/pom.xml b/code/framework/deferred/pom.xml
index b361d8bf67..d63fcea093 100644
--- a/code/framework/deferred/pom.xml
+++ b/code/framework/deferred/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/framework/encryption/pom.xml b/code/framework/encryption/pom.xml
index a1e61b7ac7..fa497b4b9e 100644
--- a/code/framework/encryption/pom.xml
+++ b/code/framework/encryption/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/framework/engine/pom.xml b/code/framework/engine/pom.xml
index 55b530fe98..0ffbf1f9e5 100644
--- a/code/framework/engine/pom.xml
+++ b/code/framework/engine/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/framework/eventing/pom.xml b/code/framework/eventing/pom.xml
index 98b2d82d44..299f43e0f7 100644
--- a/code/framework/eventing/pom.xml
+++ b/code/framework/eventing/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/framework/events/pom.xml b/code/framework/events/pom.xml
index 633a10df38..5e0a9b591b 100644
--- a/code/framework/events/pom.xml
+++ b/code/framework/events/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/framework/extension-spring/pom.xml b/code/framework/extension-spring/pom.xml
index 069f9ae798..ecbec48b13 100644
--- a/code/framework/extension-spring/pom.xml
+++ b/code/framework/extension-spring/pom.xml
@@ -4,7 +4,7 @@
cattle-parent
io.cattle
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/framework/extension/pom.xml b/code/framework/extension/pom.xml
index 25416ee83d..684188cdd6 100644
--- a/code/framework/extension/pom.xml
+++ b/code/framework/extension/pom.xml
@@ -4,7 +4,7 @@
cattle-parent
io.cattle
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/framework/java-server/pom.xml b/code/framework/java-server/pom.xml
index 55706c8ec1..54bfbe8bf7 100644
--- a/code/framework/java-server/pom.xml
+++ b/code/framework/java-server/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/framework/jmx/pom.xml b/code/framework/jmx/pom.xml
index 46954cff02..bd71083c6e 100644
--- a/code/framework/jmx/pom.xml
+++ b/code/framework/jmx/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/framework/jooq/pom.xml b/code/framework/jooq/pom.xml
index 96ffff4520..b1e7804343 100644
--- a/code/framework/jooq/pom.xml
+++ b/code/framework/jooq/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/framework/json/pom.xml b/code/framework/json/pom.xml
index 8602e3fd88..c9a2fbd143 100644
--- a/code/framework/json/pom.xml
+++ b/code/framework/json/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/framework/launcher/pom.xml b/code/framework/launcher/pom.xml
index 8cfd343d05..ef272dc9cd 100644
--- a/code/framework/launcher/pom.xml
+++ b/code/framework/launcher/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/framework/lock/pom.xml b/code/framework/lock/pom.xml
index 1777bafa07..b4068c3630 100644
--- a/code/framework/lock/pom.xml
+++ b/code/framework/lock/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/framework/logback/pom.xml b/code/framework/logback/pom.xml
index e88c5984f1..b76460b0ed 100644
--- a/code/framework/logback/pom.xml
+++ b/code/framework/logback/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-meta-parent
- 0.183.308
+ 0.183.309
../../meta-parent/pom.xml
diff --git a/code/framework/managed-context/pom.xml b/code/framework/managed-context/pom.xml
index dcaf022df6..1387e05dac 100644
--- a/code/framework/managed-context/pom.xml
+++ b/code/framework/managed-context/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/framework/metrics/pom.xml b/code/framework/metrics/pom.xml
index 99410286c3..eb6e138bbe 100644
--- a/code/framework/metrics/pom.xml
+++ b/code/framework/metrics/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/framework/module/pom.xml b/code/framework/module/pom.xml
index e9599d9e27..20f3dfbe20 100644
--- a/code/framework/module/pom.xml
+++ b/code/framework/module/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/framework/object/pom.xml b/code/framework/object/pom.xml
index df1bd955bc..84f252227c 100644
--- a/code/framework/object/pom.xml
+++ b/code/framework/object/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/framework/pool/pom.xml b/code/framework/pool/pom.xml
index 9ab44efe0c..c609efd5c3 100644
--- a/code/framework/pool/pom.xml
+++ b/code/framework/pool/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/framework/resource-monitor/pom.xml b/code/framework/resource-monitor/pom.xml
index 29716e92e0..44e7904640 100644
--- a/code/framework/resource-monitor/pom.xml
+++ b/code/framework/resource-monitor/pom.xml
@@ -4,7 +4,7 @@
cattle-parent
io.cattle
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/framework/schema/pom.xml b/code/framework/schema/pom.xml
index b40a5883e8..f99f2b5fbf 100644
--- a/code/framework/schema/pom.xml
+++ b/code/framework/schema/pom.xml
@@ -4,7 +4,7 @@
cattle-parent
io.cattle
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/framework/server/pom.xml b/code/framework/server/pom.xml
index 203399e294..401c448eb6 100644
--- a/code/framework/server/pom.xml
+++ b/code/framework/server/pom.xml
@@ -4,7 +4,7 @@
cattle-meta-parent
io.cattle
- 0.183.308
+ 0.183.309
../../meta-parent/pom.xml
diff --git a/code/framework/spring/pom.xml b/code/framework/spring/pom.xml
index 6c8930f1b7..a52e4eace0 100644
--- a/code/framework/spring/pom.xml
+++ b/code/framework/spring/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/framework/system-task/pom.xml b/code/framework/system-task/pom.xml
index a47d8fdd6c..2f07168625 100644
--- a/code/framework/system-task/pom.xml
+++ b/code/framework/system-task/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/framework/token/pom.xml b/code/framework/token/pom.xml
index 63c9116f01..fbce320a1d 100644
--- a/code/framework/token/pom.xml
+++ b/code/framework/token/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/framework/utils/pom.xml b/code/framework/utils/pom.xml
index 87a2213120..0971bcac12 100644
--- a/code/framework/utils/pom.xml
+++ b/code/framework/utils/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/iaas/agent-instance/pom.xml b/code/iaas/agent-instance/pom.xml
index 1bf32e5536..876d00a9e4 100644
--- a/code/iaas/agent-instance/pom.xml
+++ b/code/iaas/agent-instance/pom.xml
@@ -4,7 +4,7 @@
cattle-parent
io.cattle
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/iaas/agent-server/pom.xml b/code/iaas/agent-server/pom.xml
index c67b76436d..dd37d4f287 100644
--- a/code/iaas/agent-server/pom.xml
+++ b/code/iaas/agent-server/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/iaas/agent/pom.xml b/code/iaas/agent/pom.xml
index a09f89d1d7..8e43a4dec6 100644
--- a/code/iaas/agent/pom.xml
+++ b/code/iaas/agent/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/iaas/allocator/pom.xml b/code/iaas/allocator/pom.xml
index 2173abaaae..0a53d13bec 100644
--- a/code/iaas/allocator/pom.xml
+++ b/code/iaas/allocator/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/iaas/api-logic/pom.xml b/code/iaas/api-logic/pom.xml
index fcd15f5175..c1be61853d 100644
--- a/code/iaas/api-logic/pom.xml
+++ b/code/iaas/api-logic/pom.xml
@@ -4,7 +4,7 @@
cattle-parent
io.cattle
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/iaas/api-logic/src/main/java/io/cattle/platform/iaas/api/request/handler/GenericWhitelistedProxy.java b/code/iaas/api-logic/src/main/java/io/cattle/platform/iaas/api/request/handler/GenericWhitelistedProxy.java
index 134eed7c16..c843740a06 100644
--- a/code/iaas/api-logic/src/main/java/io/cattle/platform/iaas/api/request/handler/GenericWhitelistedProxy.java
+++ b/code/iaas/api-logic/src/main/java/io/cattle/platform/iaas/api/request/handler/GenericWhitelistedProxy.java
@@ -235,11 +235,11 @@ protected void generate(final ApiRequest request) throws IOException {
if (authHeader != null) {
temp.setHeader("Authorization", authHeader);
} else {
- if (uri.getPath() != null && uri.getPath().startsWith("/v1-auth/")) {
+ if (shouldUseExternalAccessToken(method, uri.getPath())) {
//set the auth service access token
String externalAccessToken = (String) request.getAttribute(AUTH_ACCESS_TOKEN);
- if(!StringUtils.isBlank(externalAccessToken)) {
- String bearerToken = " Bearer "+ externalAccessToken;
+ if (!StringUtils.isBlank(externalAccessToken)) {
+ String bearerToken = "Bearer " + externalAccessToken;
temp.setHeader("Authorization", bearerToken);
}
}
@@ -311,6 +311,19 @@ static boolean shouldFollowRedirects(Object redirectsAttribute) {
return Boolean.TRUE.equals(redirectsAttribute);
}
+ static boolean shouldUseExternalAccessToken(String method, String path) {
+ if (path == null || !path.startsWith("/v1-auth/")) {
+ return false;
+ }
+
+ // Updating authentication configuration is authorized by the control
+ // plane and can require a session-bound MFA confirmation. Preserve the
+ // caller's platform Authorization header so the authentication service
+ // can consume that confirmation as the same operator. Provider access
+ // tokens remain necessary for read-only identity/config enrichment.
+ return !("POST".equalsIgnoreCase(method) && "/v1-auth/config".equals(path));
+ }
+
static boolean isProxyableScheme(String scheme) {
return "http".equalsIgnoreCase(scheme) || "https".equalsIgnoreCase(scheme);
}
diff --git a/code/iaas/api-logic/src/test/java/io/cattle/platform/iaas/api/request/handler/GenericWhitelistedProxyTest.java b/code/iaas/api-logic/src/test/java/io/cattle/platform/iaas/api/request/handler/GenericWhitelistedProxyTest.java
index cb4e16bad5..f66f12346a 100644
--- a/code/iaas/api-logic/src/test/java/io/cattle/platform/iaas/api/request/handler/GenericWhitelistedProxyTest.java
+++ b/code/iaas/api-logic/src/test/java/io/cattle/platform/iaas/api/request/handler/GenericWhitelistedProxyTest.java
@@ -48,6 +48,28 @@ public void followsRedirectsOnlyWhenExplicitlyEnabled() {
assertTrue(GenericWhitelistedProxy.shouldFollowRedirects(Boolean.TRUE));
}
+ @Test
+ public void preservesPlatformAuthorizationForAuthenticationConfigUpdates() {
+ assertFalse(GenericWhitelistedProxy.shouldUseExternalAccessToken(
+ "POST", "/v1-auth/config"));
+ assertFalse(GenericWhitelistedProxy.shouldUseExternalAccessToken(
+ "post", "/v1-auth/config"));
+ }
+
+ @Test
+ public void keepsProviderAccessTokensForAuthenticationReadsAndOtherRoutes() {
+ assertTrue(GenericWhitelistedProxy.shouldUseExternalAccessToken(
+ "GET", "/v1-auth/config"));
+ assertTrue(GenericWhitelistedProxy.shouldUseExternalAccessToken(
+ "GET", "/v1-auth/identities"));
+ assertTrue(GenericWhitelistedProxy.shouldUseExternalAccessToken(
+ "POST", "/v1-auth/token"));
+ assertFalse(GenericWhitelistedProxy.shouldUseExternalAccessToken(
+ "POST", "/v2-beta/mfaOperation"));
+ assertFalse(GenericWhitelistedProxy.shouldUseExternalAccessToken(
+ "POST", null));
+ }
+
@Test
public void onlyAllowsHttpAndHttpsProxySchemes() {
assertTrue(GenericWhitelistedProxy.isProxyableScheme("http"));
diff --git a/code/iaas/archaius-management/pom.xml b/code/iaas/archaius-management/pom.xml
index cdc8862c00..ddbde87c57 100644
--- a/code/iaas/archaius-management/pom.xml
+++ b/code/iaas/archaius-management/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/iaas/auth-logic/pom.xml b/code/iaas/auth-logic/pom.xml
index 07e28a7e1d..f908b12672 100644
--- a/code/iaas/auth-logic/pom.xml
+++ b/code/iaas/auth-logic/pom.xml
@@ -4,7 +4,7 @@
cattle-parent
io.cattle
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/iaas/bootstrap/pom.xml b/code/iaas/bootstrap/pom.xml
index 302ad99efb..043b9b1c57 100644
--- a/code/iaas/bootstrap/pom.xml
+++ b/code/iaas/bootstrap/pom.xml
@@ -4,7 +4,7 @@
cattle-parent
io.cattle
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/iaas/config-item/api/pom.xml b/code/iaas/config-item/api/pom.xml
index 28ad121d16..d88a8c6c8f 100644
--- a/code/iaas/config-item/api/pom.xml
+++ b/code/iaas/config-item/api/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.308
+ 0.183.309
../../../parent/pom.xml
diff --git a/code/iaas/config-item/common/pom.xml b/code/iaas/config-item/common/pom.xml
index 3ef42f549f..c55e3b037c 100644
--- a/code/iaas/config-item/common/pom.xml
+++ b/code/iaas/config-item/common/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.308
+ 0.183.309
../../../parent/pom.xml
diff --git a/code/iaas/config-item/server/pom.xml b/code/iaas/config-item/server/pom.xml
index d75d7227c2..bc19322a43 100644
--- a/code/iaas/config-item/server/pom.xml
+++ b/code/iaas/config-item/server/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.308
+ 0.183.309
../../../parent/pom.xml
diff --git a/code/iaas/engine-jooq/pom.xml b/code/iaas/engine-jooq/pom.xml
index 8ffc09baa2..bf2e368945 100644
--- a/code/iaas/engine-jooq/pom.xml
+++ b/code/iaas/engine-jooq/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/iaas/events/pom.xml b/code/iaas/events/pom.xml
index d6c6a20b5c..308c6c8d52 100644
--- a/code/iaas/events/pom.xml
+++ b/code/iaas/events/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/iaas/external-handler/pom.xml b/code/iaas/external-handler/pom.xml
index 9ff8432f07..14f359046c 100644
--- a/code/iaas/external-handler/pom.xml
+++ b/code/iaas/external-handler/pom.xml
@@ -4,7 +4,7 @@
cattle-parent
io.cattle
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/iaas/ha/pom.xml b/code/iaas/ha/pom.xml
index d2c420c8df..5a4cf22e32 100644
--- a/code/iaas/ha/pom.xml
+++ b/code/iaas/ha/pom.xml
@@ -4,7 +4,7 @@
cattle-parent
io.cattle
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/iaas/healthcheck/pom.xml b/code/iaas/healthcheck/pom.xml
index a1e13d4f55..d5099d2f0f 100644
--- a/code/iaas/healthcheck/pom.xml
+++ b/code/iaas/healthcheck/pom.xml
@@ -4,7 +4,7 @@
cattle-parent
io.cattle
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/iaas/labels/pom.xml b/code/iaas/labels/pom.xml
index 6957b505df..59d11fd775 100644
--- a/code/iaas/labels/pom.xml
+++ b/code/iaas/labels/pom.xml
@@ -4,7 +4,7 @@
cattle-parent
io.cattle
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/iaas/logic-common/pom.xml b/code/iaas/logic-common/pom.xml
index 074d37885c..9be0f3fb26 100644
--- a/code/iaas/logic-common/pom.xml
+++ b/code/iaas/logic-common/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/iaas/logic/pom.xml b/code/iaas/logic/pom.xml
index 1c1f8cba99..fd006629f3 100644
--- a/code/iaas/logic/pom.xml
+++ b/code/iaas/logic/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/iaas/metadata/pom.xml b/code/iaas/metadata/pom.xml
index 6988bd453b..a6c186cd74 100644
--- a/code/iaas/metadata/pom.xml
+++ b/code/iaas/metadata/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/iaas/model/pom.xml b/code/iaas/model/pom.xml
index b824ed0746..331c456999 100644
--- a/code/iaas/model/pom.xml
+++ b/code/iaas/model/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/iaas/resource-pool/pom.xml b/code/iaas/resource-pool/pom.xml
index 1fcfb094b5..03710d5a5c 100644
--- a/code/iaas/resource-pool/pom.xml
+++ b/code/iaas/resource-pool/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/iaas/service-discovery/api/pom.xml b/code/iaas/service-discovery/api/pom.xml
index 9ee734e551..747b7aa329 100644
--- a/code/iaas/service-discovery/api/pom.xml
+++ b/code/iaas/service-discovery/api/pom.xml
@@ -4,7 +4,7 @@
cattle-parent
io.cattle
- 0.183.308
+ 0.183.309
../../../parent/pom.xml
diff --git a/code/iaas/service-discovery/server/pom.xml b/code/iaas/service-discovery/server/pom.xml
index 6c5976e9b9..649b274bcf 100644
--- a/code/iaas/service-discovery/server/pom.xml
+++ b/code/iaas/service-discovery/server/pom.xml
@@ -4,7 +4,7 @@
cattle-parent
io.cattle
- 0.183.308
+ 0.183.309
../../../parent/pom.xml
diff --git a/code/iaas/ssh-common/pom.xml b/code/iaas/ssh-common/pom.xml
index 3cb639298d..a29d94d153 100644
--- a/code/iaas/ssh-common/pom.xml
+++ b/code/iaas/ssh-common/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/iaas/storage-service/pom.xml b/code/iaas/storage-service/pom.xml
index a5484e3bea..55c2b4d430 100644
--- a/code/iaas/storage-service/pom.xml
+++ b/code/iaas/storage-service/pom.xml
@@ -4,7 +4,7 @@
cattle-parent
io.cattle
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/iaas/task-jooq/pom.xml b/code/iaas/task-jooq/pom.xml
index 9a9a176556..0172910764 100644
--- a/code/iaas/task-jooq/pom.xml
+++ b/code/iaas/task-jooq/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/implementation/activity-log/pom.xml b/code/implementation/activity-log/pom.xml
index 79ecde1501..cc8f398015 100644
--- a/code/implementation/activity-log/pom.xml
+++ b/code/implementation/activity-log/pom.xml
@@ -5,7 +5,7 @@
io.cattle
cattle-parent
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/implementation/agent-instance-impl/pom.xml b/code/implementation/agent-instance-impl/pom.xml
index f67926c240..d113cfd1bf 100644
--- a/code/implementation/agent-instance-impl/pom.xml
+++ b/code/implementation/agent-instance-impl/pom.xml
@@ -3,7 +3,7 @@
cattle-parent
io.cattle
- 0.183.308
+ 0.183.309
../../parent/pom.xml
cattle-agent-instance-impl
diff --git a/code/implementation/docker/api/pom.xml b/code/implementation/docker/api/pom.xml
index 0c54fc6beb..84df33f389 100644
--- a/code/implementation/docker/api/pom.xml
+++ b/code/implementation/docker/api/pom.xml
@@ -5,7 +5,7 @@
io.cattle
cattle-parent
- 0.183.308
+ 0.183.309
../../../parent/pom.xml
diff --git a/code/implementation/docker/common/pom.xml b/code/implementation/docker/common/pom.xml
index 4f4508d978..8c40a11533 100644
--- a/code/implementation/docker/common/pom.xml
+++ b/code/implementation/docker/common/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.308
+ 0.183.309
../../../parent/pom.xml
diff --git a/code/implementation/docker/compute/pom.xml b/code/implementation/docker/compute/pom.xml
index 9ab1bb064d..1d9f7e0b07 100644
--- a/code/implementation/docker/compute/pom.xml
+++ b/code/implementation/docker/compute/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.308
+ 0.183.309
../../../parent/pom.xml
diff --git a/code/implementation/docker/machine/pom.xml b/code/implementation/docker/machine/pom.xml
index d4794ebd80..f80bd08e18 100644
--- a/code/implementation/docker/machine/pom.xml
+++ b/code/implementation/docker/machine/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.308
+ 0.183.309
../../../parent/pom.xml
diff --git a/code/implementation/docker/storage/pom.xml b/code/implementation/docker/storage/pom.xml
index 79e5b469c2..ba8e1c740b 100644
--- a/code/implementation/docker/storage/pom.xml
+++ b/code/implementation/docker/storage/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.308
+ 0.183.309
../../../parent/pom.xml
@@ -21,12 +21,12 @@
io.cattle
cattle-docker-common
- 0.183.308
+ 0.183.309
io.cattle
cattle-iaas-allocator
- 0.183.308
+ 0.183.309
diff --git a/code/implementation/extension-api/pom.xml b/code/implementation/extension-api/pom.xml
index 7e937088c5..06a6c3ca67 100644
--- a/code/implementation/extension-api/pom.xml
+++ b/code/implementation/extension-api/pom.xml
@@ -3,7 +3,7 @@
cattle-parent
io.cattle
- 0.183.308
+ 0.183.309
../../parent/pom.xml
cattle-extension-api
diff --git a/code/implementation/hazelcast/common/pom.xml b/code/implementation/hazelcast/common/pom.xml
index 1ebe8de5c0..e3fe0986c2 100644
--- a/code/implementation/hazelcast/common/pom.xml
+++ b/code/implementation/hazelcast/common/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.308
+ 0.183.309
../../../parent/pom.xml
diff --git a/code/implementation/hazelcast/eventing/pom.xml b/code/implementation/hazelcast/eventing/pom.xml
index 2e1e0f3a37..3e9554fa7d 100644
--- a/code/implementation/hazelcast/eventing/pom.xml
+++ b/code/implementation/hazelcast/eventing/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.308
+ 0.183.309
../../../parent/pom.xml
diff --git a/code/implementation/hazelcast/lock/pom.xml b/code/implementation/hazelcast/lock/pom.xml
index 25d99abb4e..cd8985a4ca 100644
--- a/code/implementation/hazelcast/lock/pom.xml
+++ b/code/implementation/hazelcast/lock/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.308
+ 0.183.309
../../../parent/pom.xml
diff --git a/code/implementation/host-api/pom.xml b/code/implementation/host-api/pom.xml
index 60d072be8c..03c70d472a 100644
--- a/code/implementation/host-api/pom.xml
+++ b/code/implementation/host-api/pom.xml
@@ -5,7 +5,7 @@
io.cattle
cattle-parent
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/implementation/host-stats/pom.xml b/code/implementation/host-stats/pom.xml
index bae49e4e12..44cc2ec79c 100644
--- a/code/implementation/host-stats/pom.xml
+++ b/code/implementation/host-stats/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/implementation/register/pom.xml b/code/implementation/register/pom.xml
index a4af68358c..eee0f28eb6 100644
--- a/code/implementation/register/pom.xml
+++ b/code/implementation/register/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/implementation/sample-setup/pom.xml b/code/implementation/sample-setup/pom.xml
index e833c2d8d6..073560ef00 100644
--- a/code/implementation/sample-setup/pom.xml
+++ b/code/implementation/sample-setup/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/implementation/settings-api/pom.xml b/code/implementation/settings-api/pom.xml
index 338a3c7b99..d0f73df000 100644
--- a/code/implementation/settings-api/pom.xml
+++ b/code/implementation/settings-api/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/implementation/simulator/agent-connection/pom.xml b/code/implementation/simulator/agent-connection/pom.xml
index bf278baaee..afe3b732c5 100644
--- a/code/implementation/simulator/agent-connection/pom.xml
+++ b/code/implementation/simulator/agent-connection/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.308
+ 0.183.309
../../../parent/pom.xml
diff --git a/code/implementation/simulator/storage/pom.xml b/code/implementation/simulator/storage/pom.xml
index 9a49497512..de0b246356 100644
--- a/code/implementation/simulator/storage/pom.xml
+++ b/code/implementation/simulator/storage/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.308
+ 0.183.309
../../../parent/pom.xml
diff --git a/code/implementation/system-stack/pom.xml b/code/implementation/system-stack/pom.xml
index be5d1e7e77..f46b4d68d9 100644
--- a/code/implementation/system-stack/pom.xml
+++ b/code/implementation/system-stack/pom.xml
@@ -5,7 +5,7 @@
io.cattle
cattle-parent
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/implementation/vm/pom.xml b/code/implementation/vm/pom.xml
index b7515300e3..af01a4554f 100644
--- a/code/implementation/vm/pom.xml
+++ b/code/implementation/vm/pom.xml
@@ -3,7 +3,7 @@
cattle-parent
io.cattle
- 0.183.308
+ 0.183.309
../../parent/pom.xml
cattle-vm
diff --git a/code/meta-parent/pom.xml b/code/meta-parent/pom.xml
index 36161d51ae..1ab09270e6 100644
--- a/code/meta-parent/pom.xml
+++ b/code/meta-parent/pom.xml
@@ -9,7 +9,7 @@
4.0.0
io.cattle
cattle-meta-parent
- 0.183.308
+ 0.183.309
pom
PastureStack Orchestration Engine
Compatibility orchestration engine for the PastureStack server.
diff --git a/code/packaging/app-config/pom.xml b/code/packaging/app-config/pom.xml
index da912c8b6f..3b18c02a11 100644
--- a/code/packaging/app-config/pom.xml
+++ b/code/packaging/app-config/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.308
+ 0.183.309
../../parent/pom.xml
jar
diff --git a/code/packaging/app/pom.xml b/code/packaging/app/pom.xml
index fddc4707e7..9b589eabdc 100644
--- a/code/packaging/app/pom.xml
+++ b/code/packaging/app/pom.xml
@@ -4,7 +4,7 @@
cattle-parent
io.cattle
- 0.183.308
+ 0.183.309
../../parent/pom.xml
war
diff --git a/code/packaging/bundle/pom.xml b/code/packaging/bundle/pom.xml
index 0f8230d4e3..7f5bc0bc91 100644
--- a/code/packaging/bundle/pom.xml
+++ b/code/packaging/bundle/pom.xml
@@ -4,7 +4,7 @@
cattle-parent
io.cattle
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/packaging/dev/pom.xml b/code/packaging/dev/pom.xml
index c4e297e404..dd97e17918 100644
--- a/code/packaging/dev/pom.xml
+++ b/code/packaging/dev/pom.xml
@@ -4,7 +4,7 @@
io.cattle
cattle-parent
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/packaging/meta/pom.xml b/code/packaging/meta/pom.xml
index 656e22849b..c3527074ef 100644
--- a/code/packaging/meta/pom.xml
+++ b/code/packaging/meta/pom.xml
@@ -4,7 +4,7 @@
cattle-parent
io.cattle
- 0.183.308
+ 0.183.309
../../parent/pom.xml
diff --git a/code/parent/pom.xml b/code/parent/pom.xml
index e8b55035d0..7480b0c6b2 100644
--- a/code/parent/pom.xml
+++ b/code/parent/pom.xml
@@ -5,7 +5,7 @@
io.cattle
cattle-meta-parent
../meta-parent/pom.xml
- 0.183.308
+ 0.183.309
pom
diff --git a/docs/releases/orchestration-engine-0.183.309.md b/docs/releases/orchestration-engine-0.183.309.md
new file mode 100644
index 0000000000..74d1776d3a
--- /dev/null
+++ b/docs/releases/orchestration-engine-0.183.309.md
@@ -0,0 +1,20 @@
+# Orchestration Engine 0.183.309
+
+- Preserve the authenticated PastureStack caller credential for administrative
+ `POST /v1-auth/config` requests. Authentication Service can therefore consume
+ the one-time, actor-, purpose-, and digest-bound MFA confirmation as the same
+ operator that requested the access-policy change.
+- Keep the external identity provider access token for read-only auth config and
+ identity enrichment. The change is intentionally scoped to the mutating
+ configuration route and does not weaken provider lookup or Engine role checks.
+- Normalize the generated provider bearer header without leading whitespace.
+- Add regression coverage for the mutating config boundary, read-only provider
+ paths, unrelated endpoints, method case normalization, and null paths.
+
+Server consumers must verify a bound OIDC policy confirmation through the public
+`/v1-auth/config` route. A direct request to Authentication Service port 8090 is
+not sufficient because it bypasses the credential-selection boundary fixed by
+this release.
+
+Use this release with Web Console `1.6.119` and Authentication Service
+`v0.4.38`.
diff --git a/pom.xml b/pom.xml
index 93b677514e..2929d3f008 100644
--- a/pom.xml
+++ b/pom.xml
@@ -3,7 +3,7 @@
io.cattle
cattle-parent
- 0.183.308
+ 0.183.309
code/parent/pom.xml
cattle
diff --git a/resources/pom.xml b/resources/pom.xml
index 238f21add5..2172451729 100644
--- a/resources/pom.xml
+++ b/resources/pom.xml
@@ -4,7 +4,7 @@
cattle-parent
io.cattle
- 0.183.308
+ 0.183.309
../code/parent/pom.xml
diff --git a/scripts/build b/scripts/build
index faf2384d9b..006df0bfa7 100755
--- a/scripts/build
+++ b/scripts/build
@@ -16,7 +16,7 @@ fi
SOURCE_REVISION=${SOURCE_REVISION:-$(git rev-parse HEAD)}
SOURCE_DATE_EPOCH=${SOURCE_DATE_EPOCH:-$(git show -s --format=%ct HEAD)}
-ENGINE_VERSION=${ENGINE_VERSION:-0.183.308}
+ENGINE_VERSION=${ENGINE_VERSION:-0.183.309}
case "$SOURCE_REVISION" in
''|*[!0-9a-f]*)
diff --git a/scripts/check-pasturestack-source b/scripts/check-pasturestack-source
index 6a5810a7e8..a5869d3282 100755
--- a/scripts/check-pasturestack-source
+++ b/scripts/check-pasturestack-source
@@ -51,7 +51,7 @@ fi
project_version=$(sed -n 's/^[[:space:]]*\([^<]*\)<\/version>[[:space:]]*$/\1/p' code/meta-parent/pom.xml | head -n 1)
[[ "$project_version" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]] || fail non_numeric_project_version
-require_line code/meta-parent/pom.xml ' 0.183.308'
+require_line code/meta-parent/pom.xml ' 0.183.309'
require_line "$iaas_api_defaults" 'auth.service.external.id.types=github_user,github_org,github_team,shibboleth_user,shibboleth_group,ldap_user,ldap_group,oidc_user,oidc_group'
require_line code/meta-parent/pom.xml ' https://github.com/PastureStack/orchestration-engine'
require_line Dockerfile 'FROM ubuntu:26.04@sha256:2260313b31c8c011cd2eebe728008efac1b3982be73eb71348ea2648d2c0e09b'
@@ -168,7 +168,9 @@ require_line code/packaging/app-config/src/main/java/io/cattle/platform/app/Type
require_line code/framework/schema/src/test/java/io/cattle/platform/schema/processor/TokenSessionAuthOverlayTest.java ' public void clientSessionIdSurvivesAuthorizationAsCreateOnlyInput() throws Exception {'
require_line resources/src/test/java/io/cattle/platform/resources/FrozenTokenSessionSchemaTest.java ' public void everyFrozenSchemaWithTokenAcceptsClientSessionIdOnlyOnCreate()'
require_line resources/src/test/java/io/cattle/platform/resources/FrozenTokenSessionSchemaTest.java ' assertNotNull(schemaFile + " lacks token.clientSessionId", clientSessionId);'
-require_line docs/releases/orchestration-engine-0.183.308.md 'Server consumers must verify creation, mismatched deletion, matching deletion,'
+require_line docs/releases/orchestration-engine-0.183.309.md 'Server consumers must verify a bound OIDC policy confirmation through the public'
+require_line code/iaas/api-logic/src/main/java/io/cattle/platform/iaas/api/request/handler/GenericWhitelistedProxy.java ' return !("POST".equalsIgnoreCase(method) && "/v1-auth/config".equals(path));'
+require_line code/iaas/api-logic/src/test/java/io/cattle/platform/iaas/api/request/handler/GenericWhitelistedProxyTest.java ' public void preservesPlatformAuthorizationForAuthenticationConfigUpdates() {'
require_line code/packaging/app-config/src/test/java/io/cattle/platform/app/TypesConfigTest.java ' public void coreSchemaWaitsForConfigurationAndPublishesOidcProjectMemberTypes() {'
require_line code/iaas/auth-logic/src/test/java/io/cattle/platform/iaas/api/auth/identity/IdentityManagerExternalTypeTest.java ' public void rejectsUnknownExternalTypeEvenWhenProviderIsConfigured() {'
require_line code/framework/auditing/src/main/java/io/cattle/platform/iaas/api/auditing/AuditServiceImpl.java ' if (identity != null && identity.getExternalIdType() != null'
@@ -359,4 +361,4 @@ fi
require_line README.md 'PastureStack is an independent community effort to preserve, audit, and modernize the Rancher 1.6 ecosystem. It is not affiliated with or endorsed by Rancher Labs or SUSE.'
require_line ORIGIN.md '- Preserved upstream boundary: `82d154a53f4089fecfb9f320caad826bb4f6055f`'
-printf 'PASTURESTACK_SOURCE_GATE_OK version=0.183.308 runtime_sources=github_release images=digest_pinned ubuntu=26.04 ubuntu_snapshot=20260826T000000Z jdk=25.0.4 maven=3.9.16 patched_hazelcast=5.7.4 docker_cli=29.7.2 docker_host_29_8_0=exact credential_secret_capacity=mediumtext port_preflight=authoritative volume_preflight=runtime_resolution_aligned volume_preflight_project_schema=authorized volume_preflight_type_set=registered v1_hardware_schema=container-and-launchConfig network_driver_rollback=launch-config-restored stack_driver_rollback=child-launch-config-restored auth_token_session_binding=authorized-create-only auth_token_transport=bare-or-bearer-normalized auth_token_frozen_v1_schema=base-superadmin-token oidc_external_types=packaged-runtime-defaults-startup-ordered-deduplicated-reviewed-allowlist mfa_policy_confirmation=actor-purpose-digest-single-use\n'
+printf 'PASTURESTACK_SOURCE_GATE_OK version=0.183.309 runtime_sources=github_release images=digest_pinned ubuntu=26.04 ubuntu_snapshot=20260826T000000Z jdk=25.0.4 maven=3.9.16 patched_hazelcast=5.7.4 docker_cli=29.7.2 docker_host_29_8_0=exact credential_secret_capacity=mediumtext port_preflight=authoritative volume_preflight=runtime_resolution_aligned volume_preflight_project_schema=authorized volume_preflight_type_set=registered v1_hardware_schema=container-and-launchConfig network_driver_rollback=launch-config-restored stack_driver_rollback=child-launch-config-restored auth_token_session_binding=authorized-create-only auth_token_transport=bare-or-bearer-normalized auth_token_frozen_v1_schema=base-superadmin-token oidc_external_types=packaged-runtime-defaults-startup-ordered-deduplicated-reviewed-allowlist mfa_policy_confirmation=actor-purpose-digest-single-use auth_config_proxy_identity=caller-platform-credential\n'
diff --git a/scripts/check-release-artifact b/scripts/check-release-artifact
index e86868d54f..b9ed846575 100755
--- a/scripts/check-release-artifact
+++ b/scripts/check-release-artifact
@@ -4,7 +4,7 @@ set -euo pipefail
cd "$(dirname "$0")/.."
artifact=${1:-dist/artifacts/cattle.jar}
-expected_version=${EXPECTED_ENGINE_VERSION:-0.183.308}
+expected_version=${EXPECTED_ENGINE_VERSION:-0.183.309}
test -f "$artifact"
artifact=$(realpath "$artifact")